Free readiness test
ISO/IEC 27001:2022 Lead Implementer: 40 free scenario questions
Design and roll out an ISMS — scope, risk assessment, Statement of Applicability and the 93 Annex A controls.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You are leading an ISMS implementation for a 900-person payroll outsourcing company with three delivery centres, a shared HR and finance function, and a newly acquired subsidiary that builds the payroll software. Two large clients want ISO/IEC 27001 certification within 10 months as a contract condition; a third client cares mainly about the software development lifecycle. The CEO wants the scope limited to 'the Pune delivery centre' because it is the most mature site. However, all three centres use the same payroll platform, support desk and identity provider, and the subsidiary pushes code to production weekly. Internal audit flagged last year that the subsidiary's developers hold production access. The board has approved budget for one certification project only and expects the certificate to be usable in tenders for all clients.
Which scoping approach should you recommend to the steering committee?
- AScope only the Pune centre as the CEO prefers, and extend the scope in later years.
- BScope the entire group, including unrelated finance and marketing processes, to show maximum commitment.
- CScope the payroll service end to end, with documented interfaces.
- DScope only the software subsidiary, because development is the highest-risk area.